@devlab.group/agent-commerce 2.4.1 → 2.5.0

package/dist/{runtime-Cl_BLVZV.d.ts → runtime-Dz2fSO-P.d.ts}

@@ -67,6 +67,75 @@ interface AdapterDescriptor {
     readonly unsupported?: readonly string[];
 }
 
+interface CommerceReceipt {
+    readonly id: string;
+    readonly requestId: string;
+    /** Optional for compatibility with rows written before 2.5.0 */
+    readonly transactionId?: string;
+    readonly resourceId: string;
+    /** Absent for free resources */
+    readonly payment?: PaymentResult;
+    /**
+     * Present only when the resource required authorization. A method and a digest,
+     * so the receipt records that consent existed without storing the proof.
+     */
+    readonly authorization?: AuthorizationRecord;
+    readonly deliveredAt: IsoTimestamp;
+    readonly backendStatus: number;
+    readonly durationMs?: number;
+    readonly protocol?: string;
+    /** Non-secret summary only, never a sensitive backend body */
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+/** Record of a single payment authorization seen by the gateway */
+interface PaymentAttempt {
+    readonly id: string;
+    readonly requestId: string;
+    /** Optional for compatibility with rows written before 2.5.0 */
+    readonly transactionId?: string;
+    readonly resourceId: string;
+    readonly provider: string;
+    /** Unique across the store; see `PaymentResult.replayKey` */
+    readonly replayKey: string;
+    /**
+     * State of the authorization, as far as the gateway can prove it.
+     *
+     * `settlement-uncertain` means settlement was attempted and no verdict came
+     * back (RPC timeout, dropped connection, a facilitator that accepted the
+     * transfer and lost the response). The transfer may or may not have
+     * happened, so the attempt is unresolved rather than terminal and needs
+     * evidence from the chain, not a retry. `externalReference` holds the
+     * broadcast transaction hash when one is known.
+     *
+     * The execution pipeline never writes `failed`: a throw out of `settle()`
+     * never proves that nothing moved. It stays in the union because existing
+     * databases hold rows with that status.
+     */
+    readonly status: 'reserved' | 'verified' | 'settled' | 'rejected' | 'failed' | 'settlement-uncertain';
+    readonly amount: string;
+    readonly currency: string;
+    readonly payer?: string;
+    readonly payee?: string;
+    readonly externalReference?: string;
+    readonly rejectionReason?: string;
+    /** Records how an unresolved attempt became `settled` or `rejected` after its request ended */
+    readonly resolution?: PaymentAttemptResolution;
+    readonly createdAt: IsoTimestamp;
+    readonly updatedAt: IsoTimestamp;
+}
+/** Who resolved an attempt, manually or by reconciliation, and why */
+interface PaymentAttemptResolution {
+    readonly method: 'reconcile' | 'manual';
+    /** Caller-supplied identity; the admin token does not identify an individual */
+    readonly actor: string;
+    readonly reason: string;
+    readonly at: IsoTimestamp;
+    /** For `manual`, an unverified reference supplied by the operator */
+    readonly externalReference?: string;
+    /** Public chain facts only */
+    readonly evidence?: Readonly<Record<string, unknown>>;
+}
+
 /** HTTP methods a backend handler may use */
 type BackendMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
 /**
@@ -157,6 +226,13 @@ interface ResourceRegistry {
  * EVM-specific type may appear in this file.
  */
 
+/**
+ * `PaymentResult.metadata` key for public coordinates returned by `verify`
+ * for later provider reconciliation. Core must store the value unchanged and
+ * interpret only `expiresAt`. Never include signatures, payloads or
+ * transaction bytes. Experimental: may change in a minor release.
+ */
+declare const RECONCILIATION_METADATA_KEY = "reconciliation";
 /**
  * Provider-native payment challenge, opaque to core. For x402 the `accepts`
  * entries are x402 `PaymentRequirements` objects, passed to protocol adapters
@@ -263,6 +339,30 @@ interface PaymentVerificationContext {
 interface PaymentSettlementContext extends PaymentVerificationContext {
     readonly verification: PaymentResult;
 }
+/** Input to {@link PaymentProvider.reconcile}. Experimental: may change in a minor release */
+interface PaymentReconciliationContext {
+    readonly attempt: PaymentAttempt;
+    /** Coordinates from `verify`; optional for compatibility with pre-2.5.0 attempts */
+    readonly locator?: Readonly<Record<string, unknown>>;
+    readonly now: IsoTimestamp;
+}
+/** Chain evidence for resolving an attempt. Experimental: may change in a minor release */
+interface PaymentReconciliationResult {
+    /**
+     * Report `settled` only with a final transfer record for this authorization.
+     * Report `not-settled` only when a state read proves it unused after it can
+     * no longer land; missing logs or receipts are insufficient. Otherwise,
+     * report `unknown`.
+     */
+    readonly outcome: 'settled' | 'not-settled' | 'unknown';
+    /** A machine-readable token, such as `not_final` */
+    readonly reason: string;
+    readonly externalReference?: string;
+    /** Public chain facts only */
+    readonly evidence?: Readonly<Record<string, unknown>>;
+    /** For `unknown`, the earliest time a different answer is possible, if known */
+    readonly retryAfter?: IsoTimestamp;
+}
 /**
  * Contract every payment rail implements. Implementations must be
  * non-custodial: they orchestrate an external payment protocol and never hold
@@ -296,6 +396,124 @@ interface PaymentProvider {
      * returned result; the pipeline records any throw as settlement-uncertain.
      */
     settle(context: PaymentSettlementContext): Promise<PaymentResult>;
+    /**
+     * Read chain evidence for an attempt with an unknown outcome. Implementations
+     * must not write, broadcast or call a facilitator. Providers without this
+     * hook require manual resolution. Experimental: may change in a minor release.
+     */
+    reconcile?(context: PaymentReconciliationContext): Promise<PaymentReconciliationResult>;
+    health(): Promise<AdapterHealth>;
+}
+
+/**
+ * Canonical authorization model. FROZEN CONTRACT.
+ *
+ * Payment proves that funds moved; authorization proves that the human behind
+ * the agent approved this exact purchase. A valid authorization gates
+ * settlement but never unlocks a paid resource on its own and never moves
+ * money, so a resource that requires one still needs a payment proof.
+ *
+ * Core decides that a resource requires authorization and when the pipeline
+ * checks it. Authorization providers decide how a submission is parsed,
+ * verified and bound to the purchase. No AP2, SD-JWT or JWT type may appear in
+ * this file.
+ */
+
+/**
+ * Opaque authorization proof supplied by the buyer's client. Over HTTP it
+ * arrives as base64url JSON in the `Agent-Authorization` header; over MCP and
+ * A2A it is the same `{ method, payload }` object in the reserved
+ * `_authorization` input field.
+ *
+ * `payload` is kept byte for byte from the wire. It may hold signed or
+ * encoding-sensitive provider data, so transport adapters must not normalize
+ * it.
+ */
+interface AuthorizationSubmission {
+    readonly method: AuthorizationMethodName;
+    readonly payload: string;
+}
+/**
+ * What a buyer must present, advertised with the payment challenge so a client
+ * learns before it pays that a payment proof alone will not do. The gateway
+ * never issues the authorization; it names the method, the spec version it
+ * verifies against and the payload profile it expects.
+ */
+interface AuthorizationRequirement {
+    readonly method: AuthorizationMethodName;
+    readonly version: string;
+    readonly profile?: string;
+}
+/**
+ * Safe audit identity of an authorization, fit for a receipt. `reference` is a
+ * digest, because a receipt outlives its request and a stored proof would be a
+ * spendable secret at rest.
+ */
+interface AuthorizationRecord {
+    readonly method: AuthorizationMethodName;
+    readonly reference: string;
+    /** Safe audit summary only. Never the proof, its disclosures, or PII */
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+/**
+ * A verified, reserved authorization. `reservationId` is the handle the
+ * pipeline consumes, releases or marks uncertain once the payment resolves. It
+ * stays out of `AuthorizationRecord` because a handle is not an audit fact.
+ */
+interface AuthorizationVerification extends AuthorizationRecord {
+    readonly status: 'verified';
+    readonly reservationId: string;
+}
+/** Input to {@link AuthorizationProvider.verifyAndReserve} */
+interface AuthorizationVerificationContext {
+    readonly requestId: string;
+    readonly resourceId: string;
+    /**
+     * The validated resource input with reserved fields stripped: the same value
+     * the merchant backend is called with. A provider that binds a proof to the
+     * request hashes it, so it excludes `_payment`, `_authorization`, the request
+     * id and transport metadata.
+     */
+    readonly input: unknown;
+    readonly submission: AuthorizationSubmission;
+    /** The resolved price and destination the proof must match */
+    readonly requirement: PaymentRequirement;
+}
+/** Input to {@link AuthorizationProvider.consume}, `release` and `markUncertain` */
+interface AuthorizationFinalizeContext {
+    readonly requestId: string;
+    readonly resourceId: string;
+}
+/**
+ * Contract every authorization method implements.
+ *
+ * The lifecycle straddles settlement: a proof is reserved before funds move, so
+ * a replay cannot race it, and its fate is known only afterwards. A reservation
+ * is released only after a failure that provably moved no money. Anything
+ * ambiguous is marked uncertain, because a proof handed back after a settlement
+ * that may have landed can be spent twice.
+ */
+interface AuthorizationProvider {
+    readonly name: AuthorizationMethodName;
+    readonly descriptor: AdapterDescriptor;
+    /** What a buyer must present, advertised with the payment challenge */
+    readonly requirement: AuthorizationRequirement;
+    /**
+     * Verify a submission against the resolved purchase and atomically reserve it
+     * against reuse. Throws a `CommerceError` with an `AUTHORIZATION_*` code,
+     * never a payment code; a verifier or store outage is
+     * `AUTHORIZATION_PROVIDER_UNAVAILABLE`, not the buyer's fault.
+     */
+    verifyAndReserve(context: AuthorizationVerificationContext): Promise<AuthorizationVerification>;
+    /** Mark a reservation permanently spent. Called after settlement succeeds */
+    consume(reservationId: string, context: AuthorizationFinalizeContext): Promise<void>;
+    /** Return a reservation to unused. Only for failures that moved no funds */
+    release(reservationId: string, context: AuthorizationFinalizeContext): Promise<void>;
+    /**
+     * Settlement threw, so whether funds moved is unknown: neither spend the
+     * reservation nor hand it back, and flag it for an operator
+     */
+    markUncertain(reservationId: string, context: AuthorizationFinalizeContext): Promise<void>;
     health(): Promise<AdapterHealth>;
 }
 
@@ -328,5 +546,5 @@ interface IdGenerator {
 }
 declare const systemClock: Clock;
 
-export { NOOP_LOGGER as N, DEFAULT_BACKEND_TIMEOUT_MS as i, PAYMENT_METHOD_NAMES as j, PROTOCOL_NAMES as k, systemClock as t };
-export type { AdapterDescriptor as A, BackendHandler as B, Clock as C, DecimalAmount as D, IsoTimestamp as I, JsonSchema as J, Logger as L, PaymentMethodName as P, ResourceRegistry as R, CommerceResource as a, PaymentSubmission as b, AdapterHealth as c, PaymentProvider as d, IdGenerator as e, AdapterHealthComponent as f, AuthorizationMethodName as g, BackendMethod as h, PaymentChallenge as l, PaymentContext as m, PaymentRequirement as n, PaymentResult as o, PaymentSettlementContext as p, PaymentVerificationContext as q, Pricing as r, ProtocolName as s };
+export { RECONCILIATION_METADATA_KEY as M, NOOP_LOGGER as N, systemClock as O, DEFAULT_BACKEND_TIMEOUT_MS as t, PAYMENT_METHOD_NAMES as u, PROTOCOL_NAMES as v };
+export type { AuthorizationProvider as A, BackendHandler as B, Clock as C, DecimalAmount as D, PaymentRequirement as E, PaymentResult as F, PaymentSettlementContext as G, PaymentVerificationContext as H, IsoTimestamp as I, JsonSchema as J, Pricing as K, Logger as L, PaymentMethodName as P, ResourceRegistry as R, AuthorizationRequirement as a, CommerceResource as b, PaymentSubmission as c, AuthorizationSubmission as d, ProtocolName as e, AuthorizationRecord as f, PaymentAttempt as g, CommerceReceipt as h, PaymentAttemptResolution as i, AdapterDescriptor as j, AdapterHealth as k, PaymentProvider as l, IdGenerator as m, AdapterHealthComponent as n, AuthorizationFinalizeContext as o, AuthorizationMethodName as p, AuthorizationVerification as q, AuthorizationVerificationContext as r, BackendMethod as s, PaymentChallenge as w, PaymentContext as x, PaymentReconciliationContext as y, PaymentReconciliationResult as z };

package/dist/svm-KNC3PHMS.js

@@ -0,0 +1,48 @@
+import { LOCATOR_VERSION, computeSvmReplayKey } from './chunk-GA3O2A7R.js';
+import { isRecord } from './chunk-2CJNA7MS.js';
+import { getAddressEncoder, getProgramDerivedAddress, address, getCompiledTransactionMessageDecoder } from '@solana/kit';
+import { decodeTransactionFromPayload, transactionMessageHash } from '@x402/svm';
+
+var MAX_TRANSACTION_BASE64 = 1644;
+var ASSOCIATED_TOKEN_PROGRAM = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+async function associatedTokenAccount(owner, mint, tokenProgram) {
+  const encoder = getAddressEncoder();
+  const [account] = await getProgramDerivedAddress({
+    programAddress: address(ASSOCIATED_TOKEN_PROGRAM),
+    seeds: [owner, tokenProgram, mint].map((key) => encoder.encode(address(key)))
+  });
+  return account;
+}
+function inspectSvmPayload(payload, network) {
+  if (!isRecord(payload)) return "invalid_exact_svm_payload_transaction";
+  const transaction = payload["transaction"];
+  if (typeof transaction !== "string" || transaction.length > MAX_TRANSACTION_BASE64) {
+    return "invalid_exact_svm_payload_transaction";
+  }
+  let messageHash;
+  let recentBlockhash;
+  try {
+    const decoded = decodeTransactionFromPayload({ transaction });
+    messageHash = transactionMessageHash(decoded);
+    recentBlockhash = getCompiledTransactionMessageDecoder().decode(
+      decoded.messageBytes
+    ).lifetimeToken;
+  } catch {
+    return "invalid_exact_svm_payload_transaction_could_not_be_decoded";
+  }
+  return {
+    replayKey: computeSvmReplayKey({ network, messageHash }),
+    locator: { v: LOCATOR_VERSION, network, messageHash, recentBlockhash }
+  };
+}
+function messageHashOf(transaction) {
+  try {
+    return transactionMessageHash(decodeTransactionFromPayload({ transaction }));
+  } catch {
+    return void 0;
+  }
+}
+
+export { associatedTokenAccount, inspectSvmPayload, messageHashOf };
+//# sourceMappingURL=svm-KNC3PHMS.js.map
+//# sourceMappingURL=svm-KNC3PHMS.js.map

package/dist/svm-KNC3PHMS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/payments/x402/svm.ts"],"names":[],"mappings":";;;;;AAsBA,IAAM,sBAAA,GAAyB,IAAA;AAE/B,IAAM,wBAAA,GAA2B,8CAAA;AAMjC,eAAsB,sBAAA,CACpB,KAAA,EACA,IAAA,EACA,YAAA,EACiB;AACjB,EAAA,MAAM,UAAU,iBAAA,EAAkB;AAClC,EAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,wBAAA,CAAyB;AAAA,IAC/C,cAAA,EAAgB,QAAQ,wBAAwB,CAAA;AAAA,IAChD,KAAA,EAAO,CAAC,KAAA,EAAO,YAAA,EAAc,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,KAAQ,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAC,CAAC;AAAA,GAC7E,CAAA;AACD,EAAA,OAAO,OAAA;AACT;AAOO,SAAS,iBAAA,CACd,SACA,OAAA,EAC8F;AAC9F,EAAA,IAAI,CAAC,QAAA,CAAS,OAAO,CAAA,EAAG,OAAO,uCAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,QAAQ,aAAa,CAAA;AACzC,EAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,IAAY,WAAA,CAAY,SAAS,sBAAA,EAAwB;AAClF,IAAA,OAAO,uCAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,4BAAA,CAA6B,EAAE,WAAA,EAAa,CAAA;AAC5D,IAAA,WAAA,GAAc,uBAAuB,OAAO,CAAA;AAC5C,IAAA,eAAA,GAAkB,sCAAqC,CAAE,MAAA;AAAA,MACvD,OAAA,CAAQ;AAAA,KACV,CAAE,aAAA;AAAA,EACJ,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,4DAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,mBAAA,CAAoB,EAAE,OAAA,EAAS,aAAa,CAAA;AAAA,IACvD,SAAS,EAAE,CAAA,EAAG,eAAA,EAAiB,OAAA,EAAS,aAAa,eAAA;AAAgB,GACvE;AACF;AAMO,SAAS,cAAc,WAAA,EAAyC;AACrE,EAAA,IAAI;AACF,IAAA,OAAO,sBAAA,CAAuB,4BAAA,CAA6B,EAAE,WAAA,EAAa,CAAC,CAAA;AAAA,EAC7E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF","file":"svm-KNC3PHMS.js","sourcesContent":["/**\n * Solana `exact` payload inspection with bounded decoding, replay identity and\n * reconciliation coordinates. The provider loads this module, including its\n * `@x402/svm` and `@solana/kit` imports, when a Solana offer is configured.\n *\n * The facilitator checks the transaction itself: the fee payer, signatures,\n * instruction layout, mint, recipient token account and amount, and a\n * simulation. Its smart-wallet path accepts layouts the gateway could not\n * parse, so the gateway does not read the transfer.\n */\nimport {\n  address,\n  getAddressEncoder,\n  getCompiledTransactionMessageDecoder,\n  getProgramDerivedAddress,\n} from '@solana/kit';\nimport { decodeTransactionFromPayload, transactionMessageHash } from '@x402/svm';\nimport { isRecord } from '../../core/is-record';\nimport { LOCATOR_VERSION } from './locator';\nimport { computeSvmReplayKey } from './replay-key';\n\n// A Solana transaction fits a 1232-byte packet, which is 1644 base64 characters\nconst MAX_TRANSACTION_BASE64 = 1644;\n\nconst ASSOCIATED_TOKEN_PROGRAM = 'ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL';\n\n/**\n * The associated token account of `owner` for `mint`, where the SDK client\n * sends a Solana `exact` payment. Its transaction cannot create the account.\n */\nexport async function associatedTokenAccount(\n  owner: string,\n  mint: string,\n  tokenProgram: string,\n): Promise<string> {\n  const encoder = getAddressEncoder();\n  const [account] = await getProgramDerivedAddress({\n    programAddress: address(ASSOCIATED_TOKEN_PROGRAM),\n    seeds: [owner, tokenProgram, mint].map((key) => encoder.encode(address(key))),\n  });\n  return account;\n}\n\n/**\n * Returns the Solana `exact` replay key and locator, or an SDK refusal reason\n * for a missing, oversized or undecodable transaction. The provider adds the\n * payer from the facilitator's verdict when a usable address is available.\n */\nexport function inspectSvmPayload(\n  payload: unknown,\n  network: string,\n): { readonly replayKey: string; readonly locator: Readonly<Record<string, unknown>> } | string {\n  if (!isRecord(payload)) return 'invalid_exact_svm_payload_transaction';\n  const transaction = payload['transaction'];\n  if (typeof transaction !== 'string' || transaction.length > MAX_TRANSACTION_BASE64) {\n    return 'invalid_exact_svm_payload_transaction';\n  }\n  let messageHash: string;\n  let recentBlockhash: string;\n  try {\n    const decoded = decodeTransactionFromPayload({ transaction });\n    messageHash = transactionMessageHash(decoded);\n    recentBlockhash = getCompiledTransactionMessageDecoder().decode(\n      decoded.messageBytes,\n    ).lifetimeToken;\n  } catch {\n    return 'invalid_exact_svm_payload_transaction_could_not_be_decoded';\n  }\n  return {\n    replayKey: computeSvmReplayKey({ network, messageHash }),\n    locator: { v: LOCATOR_VERSION, network, messageHash, recentBlockhash },\n  };\n}\n\n/**\n * Returns the message hash of base64 transaction bytes using the same decoder\n * as payment inspection, or undefined if decoding or hashing fails\n */\nexport function messageHashOf(transaction: string): string | undefined {\n  try {\n    return transactionMessageHash(decodeTransactionFromPayload({ transaction }));\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/x402.js

@@ -1,8 +1,8 @@
-import { chainIdFromCaip2 } from './chunk-CXWC5LWM.js';
-export { createX402PaymentProvider, createX402PaymentProvider as x402 } from './chunk-CXWC5LWM.js';
-export { SUPPORTED_NETWORK_IDS } from './chunk-QPV3EGJO.js';
-import { CommerceError } from './chunk-DTKU3Z2M.js';
-import './chunk-KA2AX5FH.js';
+import { chainIdFromCaip2 } from './chunk-FKQK5XZA.js';
+export { createX402PaymentProvider, createX402PaymentProvider as x402 } from './chunk-FKQK5XZA.js';
+export { SUPPORTED_NETWORK_IDS } from './chunk-4K7FIBJM.js';
+import { CommerceError } from './chunk-3OTCFFFT.js';
+import './chunk-GA3O2A7R.js';
 import './chunk-2CJNA7MS.js';
 import { PaymentRequirementsV2Schema } from '@x402/core/schemas';
 import { getAddress, toHex } from 'viem';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devlab.group/agent-commerce",
-  "version": "2.4.1",
+  "version": "2.5.0",
   "description": "Open-source, self-hosted, non-custodial commerce and payment orchestration gateway for AI agents.",
   "license": "Apache-2.0",
   "type": "module",

package/dist/authorization-DjAecwuW.d.ts

@@ -1,115 +0,0 @@
-import { g as AuthorizationMethodName, A as AdapterDescriptor, n as PaymentRequirement, c as AdapterHealth } from './runtime-Cl_BLVZV.js';
-
-/**
- * Canonical authorization model. FROZEN CONTRACT.
- *
- * Payment proves that funds moved; authorization proves that the human behind
- * the agent approved this exact purchase. A valid authorization gates
- * settlement but never unlocks a paid resource on its own and never moves
- * money, so a resource that requires one still needs a payment proof.
- *
- * Core decides that a resource requires authorization and when the pipeline
- * checks it. Authorization providers decide how a submission is parsed,
- * verified and bound to the purchase. No AP2, SD-JWT or JWT type may appear in
- * this file.
- */
-
-/**
- * Opaque authorization proof supplied by the buyer's client. Over HTTP it
- * arrives as base64url JSON in the `Agent-Authorization` header; over MCP and
- * A2A it is the same `{ method, payload }` object in the reserved
- * `_authorization` input field.
- *
- * `payload` is kept byte for byte from the wire. It may hold signed or
- * encoding-sensitive provider data, so transport adapters must not normalize
- * it.
- */
-interface AuthorizationSubmission {
-    readonly method: AuthorizationMethodName;
-    readonly payload: string;
-}
-/**
- * What a buyer must present, advertised with the payment challenge so a client
- * learns before it pays that a payment proof alone will not do. The gateway
- * never issues the authorization; it names the method, the spec version it
- * verifies against and the payload profile it expects.
- */
-interface AuthorizationRequirement {
-    readonly method: AuthorizationMethodName;
-    readonly version: string;
-    readonly profile?: string;
-}
-/**
- * Safe audit identity of an authorization, fit for a receipt. `reference` is a
- * digest, because a receipt outlives its request and a stored proof would be a
- * spendable secret at rest.
- */
-interface AuthorizationRecord {
-    readonly method: AuthorizationMethodName;
-    readonly reference: string;
-    /** Safe audit summary only. Never the proof, its disclosures, or PII */
-    readonly metadata?: Readonly<Record<string, unknown>>;
-}
-/**
- * A verified, reserved authorization. `reservationId` is the handle the
- * pipeline consumes, releases or marks uncertain once the payment resolves. It
- * stays out of `AuthorizationRecord` because a handle is not an audit fact.
- */
-interface AuthorizationVerification extends AuthorizationRecord {
-    readonly status: 'verified';
-    readonly reservationId: string;
-}
-/** Input to {@link AuthorizationProvider.verifyAndReserve} */
-interface AuthorizationVerificationContext {
-    readonly requestId: string;
-    readonly resourceId: string;
-    /**
-     * The validated resource input with reserved fields stripped: the same value
-     * the merchant backend is called with. A provider that binds a proof to the
-     * request hashes it, so it excludes `_payment`, `_authorization`, the request
-     * id and transport metadata.
-     */
-    readonly input: unknown;
-    readonly submission: AuthorizationSubmission;
-    /** The resolved price and destination the proof must match */
-    readonly requirement: PaymentRequirement;
-}
-/** Input to {@link AuthorizationProvider.consume}, `release` and `markUncertain` */
-interface AuthorizationFinalizeContext {
-    readonly requestId: string;
-    readonly resourceId: string;
-}
-/**
- * Contract every authorization method implements.
- *
- * The lifecycle straddles settlement: a proof is reserved before funds move, so
- * a replay cannot race it, and its fate is known only afterwards. A reservation
- * is released only after a failure that provably moved no money. Anything
- * ambiguous is marked uncertain, because a proof handed back after a settlement
- * that may have landed can be spent twice.
- */
-interface AuthorizationProvider {
-    readonly name: AuthorizationMethodName;
-    readonly descriptor: AdapterDescriptor;
-    /** What a buyer must present, advertised with the payment challenge */
-    readonly requirement: AuthorizationRequirement;
-    /**
-     * Verify a submission against the resolved purchase and atomically reserve it
-     * against reuse. Throws a `CommerceError` with an `AUTHORIZATION_*` code,
-     * never a payment code; a verifier or store outage is
-     * `AUTHORIZATION_PROVIDER_UNAVAILABLE`, not the buyer's fault.
-     */
-    verifyAndReserve(context: AuthorizationVerificationContext): Promise<AuthorizationVerification>;
-    /** Mark a reservation permanently spent. Called after settlement succeeds */
-    consume(reservationId: string, context: AuthorizationFinalizeContext): Promise<void>;
-    /** Return a reservation to unused. Only for failures that moved no funds */
-    release(reservationId: string, context: AuthorizationFinalizeContext): Promise<void>;
-    /**
-     * Settlement threw, so whether funds moved is unknown: neither spend the
-     * reservation nor hand it back, and flag it for an operator
-     */
-    markUncertain(reservationId: string, context: AuthorizationFinalizeContext): Promise<void>;
-    health(): Promise<AdapterHealth>;
-}
-
-export type { AuthorizationProvider as A, AuthorizationRequirement as a, AuthorizationSubmission as b, AuthorizationFinalizeContext as c, AuthorizationRecord as d, AuthorizationVerification as e, AuthorizationVerificationContext as f };